hevnsnt/cvengine

The most advanced external attack surface assessment you can get for free.

Type in your domain. cvENGINE finds everything you expose, then tells you which of today’s exploited CVEs can actually hit you, with proof. No license fee. No per-asset pricing. No black box. 100% open source and self-hosted.

---

Know what you expose. Fix what’s exploitable first.

Attack surface tools find assets. Vulnerability scanners find flaws. Threat feeds find CVEs. cvENGINE runs all three as one continuous loop and hands you a verdict instead of a pile of alerts. It answers the question that matters: of everything exploited today, what do I have exposed?

• Total visibility. Domains, subdomains, IPs, ports, products, versions, TLS, and technologies, discovered for you and kept current in one Shodan-style inventory.
• Exploitation-ranked. Every CVE is rated fire, smoke, or ice from the real exploitation sources, then matched to what you actually run.
• Proof, not noise. AI triage plus read-only checks that reproduce the finding, with the exact command recorded.
• Nothing changes unseen. New hosts, opened ports, version bumps, and changed front pages land on a timeline.
• Yours completely. One Docker Compose stack on your own server. Bring your own AI keys, or run a local model.

Everything in the box

New in 1.3

Sentinels: scale out, and scan inside your network

Run a Sentinel on any machine and cvENGINE hands it scan work. Deploy one or a hundred to spread scanning across machines. Put one outside your network to see what the internet sees. Put one inside to reach what no outside scanner can: declare a private range, and the Sentinel finds the live hosts in it and runs the same nmap, naabu, Nuclei, TLS, UDP, WordPress, and OpenVAS checks on them, with the same CVE matching and the same dashboard. Provisioning is one copy-paste: press Provision on the Sentinels page, then docker compose up -d with the blob it gives you. Update and configure every Sentinel from cvENGINE. The client lives in hevnsnt/cvengine-sentinel. Sentinels guide

OpenVAS, built in and off by default

Switch on Greenbone’s OpenVAS from Settings and its network vulnerability tests run beside Nuclei and nmap, against the hosts you choose, on a slow, throttled, safe-checks-only schedule. Every result that names a CVE becomes a finding in the same list, the same fire, smoke, and ice ratings, and the same AI triage. Switched off, it costs nothing.

And a ton more

• Hard evidence only. A CVE match now needs the same product and a version inside a bounded affected range. A product name alone no longer makes noise, and OS and kernel flaws stay host-only.
• Asks the host what it is. Safe version and identity probes fill in the version a fingerprint missed, so more of your inventory can be matched.
• TLS audit. testssl.sh on every TLS port: protocols, ciphers, and the named TLS vulnerabilities, with hard CVE evidence.
• UDP exposure scan. DNS, NTP, SNMP, IKE, IPMI, SSDP, memcached and more, checked slowly in the background.
• Cloud storage. Public and dangling S3, Google Cloud Storage, and Azure Blob buckets.
• More of every host. Other sites on the same address, applications under subdirectories, and authenticated checks with stored headers or cookies.
• Suppliers. The vendors you depend on get a Shodan-style host card and a technology search.
• One-click PDF reports for a project or a host.
• Tailscale. Attach a tailnet, import its devices, scan them, and check its configuration.
• Host inventory and runZero. Hosts report their own OS, packages, and patches, and a runZero sync adds what it knows.
• Saved searches with alerts, per-host check coverage, internal-host flags, and a CVE match that opens on three clear cards.
• Every Nuclei template by default, LM Studio as an AI provider, one API keys page, and a friendly page while an update rebuilds.
• Supply chain you can audit. Pinned scanner versions checked before every release, and a CycloneDX bill of materials with every release.

Upgrading an existing install: upgrading to 1.3. Earlier releases are in the changelog.

How it works

flowchart LR
    T(["Add a targetdomain, IP, CIDR, URL"])

    subgraph FIND["1   FIND"]
        direction TB
        D["Discoverybbot"] --> I["Inventorynmap, naabu"]
    end

    subgraph PROBE["2   PROBE"]
        direction TB
        X["Exposure checksdatabases, RDP screenshot"] --> N1["nucleitechnology pass"] --> R["Firewall, web routeand version probes"] --> W["WordPress, WPScan,node2shell opt-in"]
    end

    subgraph MATCH["3   MATCH"]
        direction TB
        C["CVE correlation"] --> N2["nucleiAI-targeted pass"]
    end

    subgraph DECIDE["4   DECIDE"]
        direction TB
        A["AI triageand validation"] --> O["Changes, host score,dashboard, API, alerts"]
    end

    H["HygieneTLS, SPF, DKIM, DMARC, CAA, cleartext services"]

    T --> FIND --> PROBE --> MATCH --> DECIDE
    DECIDE -.-> H

    style FIND fill:#e8f1ff,stroke:#3b82f6,color:#0b3b8c
    style PROBE fill:#f1eaff,stroke:#8b5cf6,color:#3b1d8c
    style MATCH fill:#fff4e0,stroke:#f59e0b,color:#7a4a00
    style DECIDE fill:#e6f7ec,stroke:#22c55e,color:#0b5a2a
    linkStyle default stroke:#555,stroke-width:2px

    classDef start fill:#111,stroke:#111,color:#fff
    classDef step fill:#fff,stroke:#444,color:#111
    classDef out fill:#fff,stroke:#16a34a,stroke-width:2px,color:#111
    class T start
    class D,I,X,N1,R,W,C,N2,A step
    class O out
    class H step

Each scanner runs once per host inside a time window, so repeat scans stay fast. Any scanning stage can run on a Sentinel instead of the server. See the pipeline for every stage.

Built on the best

cvENGINE stands on excellent open source work. Full credits and licenses are in THIRD-PARTY.md.

Install in minutes

On a Linux server (Debian or Ubuntu is easiest, with 4 GB of RAM or more):

git clone https://github.com/hevnsnt/CVEngine.git
cd CVEngine
sudo ./install.sh

It asks nothing: it installs what is missing, generates every secret, creates the HTTPS certificate, starts cvENGINE, and prints the address and your admin password. Open the address, sign in, and add a domain. The setup wizard does the rest. Your browser will warn about the private certificate until you trust secrets/certs/ca.crt.

Step-by-step install, a public name with a trusted certificate, and Mac and Windows are in Deployment and Hosting online.

Safe by design

Read-only checks, no password lists, and no scanning of loopback, link-local, or cloud metadata addresses. Each organization’s data is isolated, stored secrets are encrypted, and access is protected by two-step sign-in, an IP allowlist, and an audit log. Only scan systems you own or are authorized to test.

Documentation

Credits and license

cvENGINE is a fork of reNgine 2.x by Yogesh Ojha and its contributors, and builds on the projects above. Thanks to our beta testers, above all camstork, whose careful reports shaped 1.3. See the changelog, contributors, and third-party software.

Released under the GPL-3.0. See LICENSE.